Skip to content

PaperCut NG/MF unauth auth-bypass → RCE chain: KEV, actively exploited (CVE-2026-82078 + CVE-2026-81578)

Why this is worth an operator page. PaperCut NG/MF — a print-management server that is frequently internet-exposed and has a history of active exploitation (CVE-2023-27350, 2023) — had a zero-day chain publicly disclosed on 2026-08-27/28 and added to CISA KEV on 2026-08-31 with confirmed in-the-wild exploitation:

  • CVE-2026-81578 — missing authentication for a critical function in the web management interface (CWE-306), CVSSv4 8.8. Unauthenticated remote requests can trigger backend administrative actions before access validation completes.
  • CVE-2026-82078 — unsafe dynamic class loading in the database connector utilities (CWE-470 "unsafe reflection"), CVSSv4 9.4. The application instantiates database driver classes from a configurable driver name with no allowlist, so an attacker who can manipulate system configuration can execute arbitrary Java bytecode from the application classpath under the PaperCut server process.

The chain is unauthenticated, remote, and end-to-end public (vendor advisory + Rapid7 ETR + open Metasploit module). This page gives the durable operator workflow: exposure recon, chain-aware version fingerprinting, safe boundary validation, and compromise-verification checks.

Public exploit path (confirmed in vendor/Rapid7 disclosure and public tooling)

The chain exploits PaperCut's use of the Apache Tapestry framework, whose "complex direct" request format can name one page to display and a different page containing the component to execute — while access control is validated only against the displayed page.

  1. Auth bypass (CVE-2026-81578). Display the public Error page while invoking administrative components from ConfigEditor or UserList. Documented request shapes (the numeric path segment can be any value; Exception or Home may substitute for Error in some patch states):
POST /app?service=direct/1/Error/ConfigEditor/quickFindForm
POST /app?service=direct/1/Error/ConfigEditor/$Form
POST /app?service=direct/1/Error/UserList/$QuickFind.$Form

The first two give unauthenticated access to the configuration editor. The vendor's Emergency Patch Release 1 could be bypassed by displaying the Home page instead of Error; Emergency Patch Release 2 remediates that bypass.

  1. Config manipulation. Rewrite the four external user-lookup settings that are normally admin-gated:
user-lookup.db-driver
user-lookup.db-url
user-lookup.id-to-username-sql
user-lookup.enabled

  1. Unsafe driver class loading (CVE-2026-82078). The database connector instantiates the driver class named in user-lookup.db-driver without an allowlist. Pointing it at the bundled H2 driver opens an attacker-controlled H2 JDBC URL; an inline INIT statement creates a JavaScript-backed database trigger, and the bundled Nashorn engine (or any equivalent mechanism) runs an OS process from that trigger.

  2. Trigger. A forged UserList search invokes the external lookup, which executes the malicious SQL and fires the trigger. Public module output shows a session running as SYSTEM on Windows; the module also supports Java and command payloads on 24.x–26.x.

Patch state matters. Emergency Patch Release 1 (2026-08-28) is not sufficient — the Home-page display variant bypasses it. Only Emergency Patch Release 2 remediates the disclosed chain. "Patched" must be verified against the v2 builds, not just the patch's existence.

Recon: exposure and version fingerprinting

PaperCut NG/MF instances are identifiable and versionable from the outside with inert probes:

  • Product markers: PaperCut web UI titles, pc-app/pc-client asset paths, the management interface at /app, and version.txt/version endpoints where reachable. Public module checks report the exact build, e.g. PaperCut MF 26.0.4 (Build 76494).
  • Version/build identification: capture the product version string; the public disclosure targets 26.x, 25.x, and 24.x (vendor considers all versions of NG and MF potentially impacted). Record exact build for scoping.
  • Exposure classification: determine whether the PaperCut Application Server web interface is directly internet-reachable or sits behind a trusted-IP restriction. Internet-exposed instances are the priority tier.
# Inert recon on an authorized scope: identify PaperCut front-ends and version markers
httpx -l scope.txt -title -tech-detect -content-length -server -cookie -silent -json > httpx_pc.json
nuclei -l scope.txt -t technologies/ -t misconfiguration/ -silent -json > nuclei_pc.json
# Version markers on a confirmed PaperCut host (read-only GETs)
curl -sk -D - https://TARGET/app -o /dev/null -w "HTTP %{http_code}\n"
curl -sk https://TARGET/version.txt

Label inference. If you cannot read an exact build, record the fingerprint evidence (page titles, markers, error bodies) and note version confirmation is inferred, not confirmed.

Validation boundaries (authorized targets / lab only)

This chain is public and automated. In an authorized assessment the safe work is boundary confirmation, not payload execution:

  1. Confirm the component and patch state with read-only version markers (above). Do not send exploit payloads at an in-scope production system without explicit owner approval for that specific action.
  2. In a lab (or owner-approved canary host), prove the auth boundary with the display-page differential: request the ConfigEditor component under a public display page and record that an unauthenticated request reaches the component handler. A minimal inert proof is the configuration-editor page rendering or its error/redirect differential vs. a patched build — not driver config writes and not SQL execution.
  3. Characterize the driver-allowlist boundary without execution: capture that user-lookup.db-driver is accepted as arbitrary input in the (patched-negative) config schema. Stop at input acceptance. Do not set a malicious JDBC URL, do not create H2 triggers, do not spawn processes.
  4. Do not run the public Metasploit module or third-party exploit code against targets. It is untrusted code, it opens real sessions, and it is a detection artifact for the owner. Your own boundary diff (unauth component reach + config-input acceptance + patch state) is the report.
  5. Negative control: repeat the auth-bypass shape against an Emergency Patch Release 2 build and record the denial.

Evidence to capture: exact product/version string, display-page vs. component matrix (which display pages pass auth on which patch states), the four user-lookup.* keys' accessibility, patch-state confirmation (v1 vs v2), and the negative control on patched builds. Redact all credentials and session material.

Compromise verification (owner-directed, lab or approved systems)

If the asset owner asks whether a system was hit by the in-the-wild campaign, the vendor-documented indicators are operator-checkable:

  • Application activity: ID/EDR/network alerts on the PaperCut Application Server, especially post-exploitation activity associated with pc-app.exe.
  • Log integrity: missing, truncated, or deleted server.log.
  • server.log content: ERROR No suitable driver found for jdbc:no:x and ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST entries.
  • Vendor has not published validated network IOCs; absence of IOCs is not evidence of non-compromise.

These checks are read-only (log review, process telemetry) and should be scoped to owner-approved systems.

Durable operator value

  1. Display-page/component split is a reusable authz audit axis. Any Tapestry-style (or similar MVC) framework where the displayed page and the executed component are decoupled in the request URL needs a full matrix test: every public display page × every admin component. The public page is the proxy for the auth check.
  2. Config-parameter-to-class-load is a reflection RCE class. Any "driver name", "handler class", "plugin class", or "template class" setting that reaches Class.forName/instantiate without an allowlist is a chain leg. Audit all *-driver, *-class, *-plugin style config keys for allowlisting.
  3. Patch-version differentials are part of the vuln. A patch that hardens one entry (Error page) but not siblings (Home page) is still live. Always test the patch's actual control surface, and treat "patch applied" as unverified until the specific bypass shape is negative.
  4. Chained KEVs beat standalone CVEs. Here the 8.8 auth bypass alone is a config-write; the 9.4 reflection flaw alone needs a config write. The chain is unauthenticated RCE. When two KEV entries for one product say "can be chained", the operator workflow is the chain, not either CVE.
  5. Print/legacy appliance surface: PaperCut, Konica, Xerox, and similar office appliances sit on the internet far more than their risk profile warrants, and have repeat exploitation history. Include them in perimeter recon sweeps even when the org "doesn't think they're exposed".

October 14 KEV follow-up: Ahsay AhsayCBS — the same chained-KEV shape lands on a backup appliance (CVE-2026-105133 + CVE-2026-105134)

CISA added the Ahsay AhsayCBS pair to KEV on 2026-10-14, and the KEV text itself carries the chain: CVE-2026-105133 (improper authentication in the API component's checkSysPwd function, manipulated via the random parameter) "can be chained with" CVE-2026-105134 (OS command injection through the same-named random parameter on the Replication Receiver component's /rps/api/json/UpdateReceivers.do endpoint) = unauthenticated → remote OS command execution on the backup server. Three operator notes on top of this page's rules:

  1. Same parameter name across two components is the chain's seam. random is malformed in both legs: it breaks auth on one component and reaches a shell on the other. When a vendor/KEV description repeats a parameter name across two CVEs, the endpoint pair is one workflow, and the auth-bypass leg's output (an accepted session/token) is the cmdi leg's input — probe the sink endpoint's parameter with the pre-auth shape first.
  2. Backup-appliance components are separate attack planes again (this page's Rule 4 energy, and the Veeam page's per-listener rule): AhsayCBS splits an API component and a Replication Receiver (/rps/...) component — route-family inventories on backup appliances should enumerate component prefixes (/rps/api/json/, /client/, /api/) and test authz per family, not per UI page. MSP backup servers running Ahsay/Veeam/Vembu-class products belong on the external recon list by default (rule 5 extended from print to backup).
  3. Detail level stays sparse (VulDB-origin, no sink analysis published). Validation posture: authenticated-lab-only for the cmdi leg (disposable AhsayCBS instance, inert marker in the random field on your own receiver config), route/auth-gating evidence in the field, never the chained exploit against a production backup server — a cmdi on a backup appliance is a whole-customer-base incident. KEV presence justifies ownership confirmation and patch-state checks; the wiki frames this as a perimeter-recon + lab-fixture item until sink detail lands.

Also landed in the same KEV delta (2026.10.14, 1745): CVE-2026-76519 Cisco Secure Email Gateway unauthenticated relative path traversal → arbitrary file write (now KEV-confirmed; inspection-engine framing already noted on the Oct 14 Juniper page) and CVE-2026-0322 PAN-OS authenticated root code injection (detail-free; tracked fold-when-detail-lands, post-auth framing only).

Safety

  • Authorized scope only. The chain is unauthenticated and destructive-capable; any write request to a production PaperCut is an incident. Confirm the owner's approval level (recon vs. boundary proof vs. exploit validation) before each action.
  • No payload execution in scope unless explicitly approved; no process spawning, no driver reconfiguration, no trigger creation.
  • Do not run untrusted public exploit code (Metasploit module or GitHub PoCs) against any target; treat it as untrusted and use it only for lab reproduction with full owner sign-off.
  • Compromise checks are read-only and owner-directed; preserve log evidence rather than modifying it.

Sources: CISA KEV catalog · NVD CVE-2026-82078 · NVD CVE-2026-81578 · PaperCut urgent security bulletin 27 Aug 2026 · Rapid7 ETR: PaperCut NG/MF critical zero-day exploited in the wild · Metasploit PR #21842 (open, untrusted tooling reference)